devplatform-cli@35.7.4

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Runtime import of the main entrypoint, including require('devplatform-cli').

Arbitrary native code execution under the importing user's privileges.

remote payload download, temporary-file drop, and detached shell execution

The main entrypoint silently imports _adapter.js. On first import per marker TTL, it fetches a platform-specific executable from obscured Workers hosts, falling back to DNS TXT chunking under wel1.ru. It drops the response into a temporary executable file and starts it detached through cmd.exe or /bin/sh. This is a concrete import-time remote-code-execution chain.

Source directly establishes import-time download-and-execute behavior with no user command or consent boundary. The telemetry module independently contains the same payload-loader pattern, reinforcing intent.